Threat Actors Advertised NtKiller Malware on Dark Web Claiming Terminate Antivirus and EDR Bypass
A tool named NtKiller, developed by a malicious entity referred to as AlphaGhoul, has been introduced on a clandestine forum. This tool is reportedly capable of disabling antivirus and endpoint detection systems, allowing malware to execute undetected on…
A tool named NtKiller, developed by a malicious entity referred to as AlphaGhoul, has been introduced on a clandestine forum. This tool is reportedly capable of disabling antivirus and endpoint detection systems, allowing malware to execute undetected on compromised devices.
NtKiller is advertised as being effective against several well-known security solutions, including Microsoft Defender, ESET, Kaspersky, Bitdefender, and Trend Micro. The tool claims to bypass Enterprise Detection and Response (EDR) systems when deployed in aggressive modes. Notably, it employs early-boot persistence mechanisms, making it challenging for security teams to identify and mitigate once activated.
The tool is offered with a modular pricing structure. The base functionality is priced at $500, while additional features, such as rootkit capability and User Account Control (UAC) bypass, are available for $300 each. This pricing model indicates that the tool is marketed for commercial distribution within cybercriminal circles.
A tool named NtKiller, developed by a malicious entity referred to as AlphaGhoul, has been introduced on a clandestine forum.
NtKiller's advanced features include disabling Hypervisor-protected Code Integrity (HVCI), manipulating Virtualization-Based Security (VBS), and evading memory integrity checks. These capabilities make the tool particularly potent in experienced hands, as it can execute malicious payloads before security systems are fully operational.
Anti-debugging and anti-analysis techniques further obscure its operations, hindering attempts by researchers and automated tools to analyze its behavior. The UAC bypass feature allows it to gain elevated system privileges without alerting users, while rootkit functionality enables persistent access to compromised systems, remaining undetected by standard security measures.
Despite its promoted capabilities, independent verification by third-party researchers is lacking, leaving the actual effectiveness of NtKiller uncertain. It is advised that organizations enhance their security protocols with behavioral detection measures that extend beyond signature-based identification to counteract such emerging threats.
Based on reporting by Cyber Security News.